ciberfauna/sabia
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

v0.1.0: logo, i18n pt/en, CI com caches, testes e documentação

Browse Source 
- Logo oficial (sabia.png) e conjunto de ícones do app desktop.
- Interface em português e inglês: tradutor por observação do DOM, seletor
  de idioma e checagem de cobertura de tradução no CI.
- CI/CD com caches (rust-cache, .deb do Tauri em cache) e pipeline de release
  multiplataforma (CLI em 5 alvos + app desktop via tauri-action), templates
  de issue/PR.
- Suíte de testes de integração do sabia-core (scan e2e, handshake/crack
  4-way e PMKID, pcap, trilha de auditoria) — 46 testes verdes.
- Documentação completa pt/en: README, ROADMAP, SECURITY, CONTRIBUTING,
  CHANGELOG e docs/ (cli, interface, arquitetura), com enquadramento de uso
  autorizado.
- Correções de clippy (-D warnings) e formatação em toda a árvore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Lucas RayanandClaude Opus 5.5 committed 2026-10-23 12:46:19 -03:00
1 parent df27974359
commit 791538c9d9
112 files changed
+15620 -494
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+99 -38
View File
@@ -1,51 +1,112 @@
# Sabiá
<p align="center"><img src="apps/gui/ui/sabia.png" width="300" alt="Sabiá"></p>
<h1 align="center">Sabiá</h1>
<p align="center">Free and open Wi-Fi auditing.<br>Terminal and desktop app · live capture on Linux, offline analysis on Windows, Linux and macOS · authorized use.</p>
Auditoria, monitoramento e pentest de redes Wi-Fi — terminal e interface
gráfica sobre o mesmo núcleo, com foco na interface gráfica e uso
intuitivo: a parte complexa (netlink, radiotap, parsing de quadro 802.11)
fica escondida em `sabia-core`; CLI e GUI só consomem.
<p align="center"><a href="docs/cli.md">Terminal</a> · <a href="docs/interface.md">Interface</a> · <a href="docs/architecture.md">Architecture</a> · <a href="ROADMAP.md">Roadmap</a> · <a href="CHANGELOG.md">Changelog</a></p>
> Use apenas em redes próprias ou com autorização explícita do responsável
> pela rede (engajamento de pentest formal). Toda ativação de modo monitor
> e sessão de captura é registrada numa trilha de auditoria local
> encadeada por hash (`.sabia-audit.log`).
<p align="center"><b>English</b> · <a href="README.pt-BR.md">Português</a></p>
## Estrutura
---
```
crates/sabia-core biblioteca: netlink (iw), radiotap, parsing 802.11,
captura crua (AF_PACKET), auditoria, auto-atualização
crates/sabia-cli binário `sabia`: comandos de terminal + servidor
local da interface (`sabia ui`)
apps/gui/ui mesma página HTML/JS servida pelo `sabia ui` e pelo app desktop
apps/gui/src-tauri app desktop (Tauri) — pede administrador/root ao abrir
Sabiá brings together, in a single sweep, what tools like `airodump-ng`, `hcxdumptool`, `aircrack-ng` and `wifite` do separately — in one Rust binary, with no `libpcap` dependency:
- **Network discovery:** hops across the **2.4, 5 and 6 GHz** channels and lists access points and associated clients, with SSID, BSSID, channel, signal and security type.
- **Monitor mode without scripts:** turns the card's monitor mode on and off straight through netlink/`iw`, and shows which channels the radio supports.
- **Handshake capture:** recognizes the **4-way handshake (EAPOL)** and the **PMKID** on the air and keeps only what offline cracking needs.
- **Offline dictionary cracking:** recomputes the PMK with **PBKDF2-HMAC-SHA1** and checks the **MIC** (4-way) or the **PMKID** (`HMAC-SHA1(PMK, "PMK Name" …)`) — for WPA/WPA2-PSK.
- **pcap round-trip:** writes captured frames to `.pcap` and **analyzes a `.pcap` offline** (networks, clients and handshakes), interoperable with the other tools.
- **Deauthentication test:** sends _deauth_ to an AP/station to force a reassociation — only with an explicit authorization confirmation (`--yes`).
- **Audit trail:** every monitor-mode activation and capture session is recorded in a local **hash-chained** trail.
- **Diagnostics:** `doctor` checks privileges, tools and interfaces before you start.
## Authorized use
Sabiá is an **auditing** tool — for testing the security of networks you **own** or have **explicit authorization** to assess.
- Capturing handshakes, sending deauthentication or cracking passwords on third-party networks **without permission is illegal** in most countries. The responsibility is the operator's.
- Deauthentication (`deauth`) requires the `--yes` flag, an assertion that you are authorized to test that network.
- Every monitor-mode activation and capture session is **recorded in the local audit trail** (`sabia audit show`), hash-chained to detect tampering.
- **Nothing of yours leaves the machine.** The only network access by default is the update check on startup (which can be disabled).
- Dictionary passwords and handshakes stay on your machine.
## Install
Download the package for your system from **[Releases](../../releases)**:
| | CLI | Desktop app |
|---|---|---|
| Windows | `sabia-*-windows-x86_64.zip` | `.msi` / `.exe` installer |
| macOS | `sabia-*-macos-{aarch64,x86_64}.tar.gz` | `.dmg` |
| Linux | `sabia-*-linux-{x86_64,aarch64}.tar.gz` | `.AppImage` / `.deb` |
Each file has a `.sha256` next to it. Build from source: `cargo build --release -p sabia-cli` (Rust 1.80+).
**Updates:** the desktop app checks GitHub on startup; when a new version exists, a button offers **Update now**: it downloads the right binary for your platform, verifies the **SHA-256** and swaps the running executable — no manual download. The check is a single request to the releases API and sends nothing of yours.
> The binaries are **not signed yet**: Windows SmartScreen and macOS Gatekeeper will warn. Check the SHA-256.
**Capture and monitor mode require Linux and root** (`CAP_NET_ADMIN`/`CAP_NET_RAW`): raw capture uses `AF_PACKET` and interface control uses netlink. **Offline `.pcap` analysis and cracking** also run on Windows and macOS. The desktop app elevates to administrator on its own at startup.
## Getting started
```bash
sabia doctor # privileges, tools and interfaces
sabia iface list # Wi-Fi interfaces and their modes
sudo sabia iface monitor wlan0 on # enable monitor mode
sudo sabia scan wlan0 --band all --out air.pcap # hop channels and record the air
sabia analyze air.pcap # read a .pcap offline
sabia crack air.pcap --wordlist list.txt # crack the handshake by dictionary
```
## Uso
Authorized deauthentication testing and all other commands (`audit`, `update`, `ui`) are in **[docs/cli.md](docs/cli.md)**.
## Desktop app
Desktop app (Tauri) with an interface sidebar, a capture panel with an animated signal line, and a networks table with signal bars and color-coded security badges. The same front-end runs in the browser with `sabia ui`. More in **[docs/interface.md](docs/interface.md)**.
- Pick the interface, toggle **monitor mode** and start/stop **capture** by button.
- Live **networks seen** table, with signal, channel and security.
- An **authorized-use** notice always in view and automatic privilege elevation on startup.
- One-click **update** button, **Auto, Light and Dark** themes and interface in **Portuguese and English**.
## Known limits
- **Capture is Linux-only**, with a card that supports **monitor mode** (and injection, for `deauth`). On Windows and macOS Sabiá only does `.pcap` analysis and offline cracking.
- **WPA3/SAE** does not fall to handshake dictionaries — cracking covers **WPA/WPA2-PSK** (4-way and PMKID).
- **5 and 6 GHz** depend on the card and the regulatory domain; some channels stay passive (no probing).
- **Passwords outside the dictionary don't come back:** cracking is dictionary force only, no rules or masks yet.
- **Windows and macOS:** the code compiles and is tested in CI, but live capture does not run on those platforms.
## Where it's going
Summary of the [ROADMAP](ROADMAP.md):
| | |
|---|---|
| **Done** | Monitor mode via netlink, 2.4/5/6 GHz scanning, 4-way and PMKID capture, `.pcap` read/write, dictionary cracking (WPA/WPA2-PSK), authorized `deauth`, hash-chained audit trail, `doctor`, CLI + desktop app, one-click update |
| **Next** | Rules and masks in cracking, GPU acceleration, export to the hashcat format (`22000`) |
| **Later** | WPS attack, rogue AP / evil twin for authorized testing, capture on Windows (Npcap) |
| **Long term** | WPA3/SAE downgrade, validation on varied hardware |
## Development
```
sabia iface list # lista interfaces, marca as Wi-Fi
sabia iface monitor <if> on # liga modo monitor (precisa root)
sabia scan <if> --out captura.pcap # varre canais, mostra APs/clientes
sabia ui # abre a interface gráfica local
sabia update # verifica atualização
sabia update --apply # baixa e aplica a atualização
crates/sabia-core core: interfaces, netlink, radiotap, 802.11, EAPOL, handshake, capture, crack, audit, update
crates/sabia-cli the `sabia` binary (CLI + local UI server)
apps/gui interface (ui/ = HTML, CSS and JS; src-tauri/ = desktop app)
scripts/ CI helpers (cached dependency install, i18n coverage check)
docs/ terminal, interface and architecture
```
Ou baixe o app desktop em [Releases](https://github.com/lucasrguerra/sabia/releases)
— ele pede elevação de administrador/root automaticamente ao abrir, já que
modo monitor e captura crua exigem esse privilégio em qualquer sistema.
```bash
cargo test --workspace
cargo clippy --workspace --all-targets
node scripts/check-ui-i18n.mjs # UI translation coverage
```
Pela CLI, capturar quadros 802.11 exige `CAP_NET_RAW`/`CAP_NET_ADMIN` —
normalmente root (`sudo sabia ...`).
See [CONTRIBUTING.md](CONTRIBUTING.md) and [docs/architecture.md](docs/architecture.md). Versions follow [SemVer](https://semver.org/); changes in [CHANGELOG.md](CHANGELOG.md). To release: `git tag vX.Y.Z && git push --tags` (the `release` workflow builds and publishes everything). Vulnerabilities: [SECURITY.md](SECURITY.md).
## Dependências externas
## License
`iw` e `ip` (iproute2) para controlar modo monitor e canal — é uma ponte
deliberada até existir uma implementação nl80211 nativa. A captura em si
(AF_PACKET) e todo o parsing de quadro são Rust puro, sem libpcap.
## Hardware testado
Adaptador USB RTL8812AU (driver `rtw88_8812au`), suporta modo monitor e
injeção.
[MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), your choice.